FSSO using Syslog as source
This example describes how to configure Fortinet Single Sign-On (FSSO) agent on Windows using syslog as the source and a custom syslog matching rule.
The FSSO collector agent must be build 0291 or later, and in advanced mode (see How to switch FSSO operation mode from Standard Mode to Advanced Mode).
To configure the FSSO agent on Windows:
-
Open the FSSO agent on Windows.
-
Click Advanced Settings.
-
Go to the Syslog Source List tab.
-
Select Enable this feature.
-
Set Syslog Listening Port, or use the default port.
-
Click Manage Rule.
-
Create a new syslog rule:
-
Click Add.
-
Configure the rule:
Trigger
722051
Logon
assigned to session
Username Field
User <{{:username}}>
Client IPv4 Field
IPv4 Address <{{:client_ip}}>
Client IPv6 Field
IPv6 Address <{{:client_ipv6}}>
Group Field
Group <{{:group}}>
Groups List Separator
,
-
To test the rule, enter a sample log line, then click Test.
-
Click OK.
-
-
Create a new syslog source:
-
On the Advanced Settings window, click Add.
-
Configure the source:
Name
VPN-Connection
IP Address
192.168.100.12
Matching Rule
VPN
User Type
External: Users are not defined on the CA and user groups come from the source.
Remote User: Users are defined on a remote LDAP server and user groups are retrieved from the specified LDAP server. Any group from the syslog messages are ignored. See Connect to a remote LDAP server .
-
Click OK.
-
-
Click OK.
Connect to a remote LDAP server
This section describes how to connect to a remote LDAP server to match the user identity from the syslog server with an LDAP server.
To connect to a remote LDAP server:
-
Open the FSSO agent on Windows.
-
Click Advanced Settings.
-
Go to the Syslog Source List tab.
-
Click Manage LDAP Server.
-
Click Add and configure the LDAP server settings:
-
Click OK.
-
Select the syslog source and click Edit.
-
Set User Type to Remote User, and select the LDAP server from the drop-down list.
-
Click OK.